[tor-relays] Tor non-exit list

[Carsten Otto]

Hi Dan,

For reference:
https://www.dan.me.uk/dnsbl
https://www.dan.me.uk/tornodes
https://www.dan.me.uk/torlist/?full

First of all, thank you for your tools and other contributions. The mere
fact that your DNS blocklists are used by countless vendors should be a
compliment in itself, and I'd be happy to have that much impact with my
own projects.

As you already state on your own site ("Please think carefully
before choosing to use this list for blocking purposes"), your non-exit
Tor relay list is a bit unusual. I'm running ftp.halifax.rwth-aachen.de,
a major file mirror serving around 30 TByte of data at around 4 GBit/sec
(on average). Recently, we added Tor relays on the same IP address, and
your list correctly picked this up (137.226.34.46).

Now, I'm writing as this caused quite a lot of mayhem. Several
"security" appliance vendors didn't "think carefully" before adding your
non-exit list to their devices. Among those are Arbor Prevail, Check
Point, Ubiquiti (UniFi) - feel free to search for

  "ET TOR Known Tor Relay/Router (Not Exit) Node"

to see the effect of this. In addition to private users making use of
such devices, several banks/corporations/institutions started blocking
our IP address, causing some frustration with us and their admins, as
their Linux/Jenkins/... updates suddenly stopped working. As you might
have guessed, changing "security" configurations (even if they may be
wrong or questionable) is quite a challenge, and in some cases the
(motivated) admins weren't unable to fix this issue on their end.

As you seem to be well aware of what Tor is, what an exit relay does and
what a non-exit relay does, would you be willing to retire the non-exit
blocklist (at least the part that can be used for automated blocks)? I'd
argue that the current setup does more harm than good (assuming you
agree that Tor is a good thing in general). I'd be happy to discuss pros
and cons, but ultimately that's your decision to make.

Thanks
Carsten
-- 
Dr. Carsten Otto
http://verify.rwth-aachen.de/otto/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20240619/c99b63d9/attachment.sig>